PT-2019-14951 · Zoho · Zoho Manageengine Datasecurity Plus

Dominique Righetto · Publicado 2019-10-09 · Atualizado 2019-11-20 · CVE-2019-17112

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AC:L/AV:N/A:N/C:L/I:N/PR:L/S:U/UI:N

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine DataSecurity Plus versions prior to 5.0.1 5012

Description An issue was discovered that allows a basic user with "Operator" access level to access the configuration file of the mail server, excluding the password, due to an exposed service.

Recommendations For versions prior to 5.0.1 5012, update to version 5.0.1 5012 or later to resolve the issue.

Correção

Files Accessible to External Parties

Enumeração de Fraquezas

CWE-552

Identificadores relacionados

CVE-2019-17112

Produtos afetados

Zoho Manageengine Datasecurity Plus

Referências · 4

• https://excellium-services.com/cert-xlm-advisory/cve-2019-17112 · Nota
• https://manageengine.com/data-security/release-notes.html · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-17112 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-17112 · Nota de Segurança